bugGNUstep - Bugs: bug #29764, NSURLProtocol unescapes URL...

Group
 
 

bug #29764: NSURLProtocol unescapes URL requests before sending

Submitter:  Adam Fedor <fedor>
Submitted:  Tue 04 May 2010 12:01:55 AM UTC
   
 
Category:  Base/Foundation Severity:  3 - Normal
Item Group:  Bug Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Wed 05 May 2010 05:21:41 PM UTC, comment #9: 

Well, it's pretty good for now.  I'll do some debugging later and see if I can understand it better.

Adam Fedor <fedor>
Group administrator
Wed 05 May 2010 04:09:08 PM UTC, comment #8: 

The _urlString ivar is the relative part of the URL ... it's not necessarily just the path (and it might only be part of the path).
I'm not saying we can't mimic OSX private behaviors, just that it's not straightforward/simple to do it.

Richard Frith-Macdonald <CaS>
Group Member
Wed 05 May 2010 03:50:12 PM UTC, comment #7: 

What about _urlString? That appears to be the original string passed in (not sure if baseURL should be included as well, I don't think I understand this well).

Adam Fedor <fedor>
Group administrator
Wed 05 May 2010 03:33:19 PM UTC, comment #6: 

The problem with the fragment should be fixed now.

Richard Frith-Macdonald <CaS>
Group Member
Wed 05 May 2010 03:22:08 PM UTC, comment #5: 

As far as I can tell, there's no API to get the original path from an NSURL ... so if OSX is doing that, I guess it must be using some private API.
Possibly we could work under debug to reverse-engineer that ... but we don't store the  original string, so t would be quite a rewrite.

Richard Frith-Macdonald <CaS>
Group Member
Wed 05 May 2010 03:13:10 PM UTC, comment #4: 

To make it even more complex. Try sending this URL:

http://localhost/~fedor/all.cgi?Hi%23There%40You@Are#Cool

From MacOSX:
REQUEST_URI='/~fedor/all.cgi?Hi%23There%40You@Are'
from GNUSTEP:
REQUEST_URI='/~fedor/all.cgi#Cool?Hi%23There%40You@Are'

Perhaps I could do more testing to figure out how things really work...

Adam Fedor <fedor>
Group administrator
Wed 05 May 2010 03:06:26 PM UTC, comment #3: 

That at least works with my application, but I can't help but think it should just pass on the original value of the URL instead of unescaping the URL and then escaping it again.  To be more concrete, I've attached a simple test program which sends stuff to a local web server  (all.cgi = "#/bin/sh\nset\n"). The sent URL is:

http://localhost/~fedor/all.cgi/Hi%23There%40You@AreCool

Sent from MacOSX, I get:
REQUEST_URI=/~fedor/all.cgi/Hi%23There%40You@AreCool
From gnustep-base:
REQUEST_URI=/~fedor/all.cgi/Hi%23There@You@AreCool

which leads me to believe that MacOSX does not do anything to the URL before sending it..



(file #20449)

Adam Fedor <fedor>
Group administrator
Wed 05 May 2010 01:45:44 PM UTC, comment #2: 

Yep ... fixed to add percent escapes to the path in the request.
Also applied similar fix to GSHTTPURLHandle.m


Richard Frith-Macdonald <CaS>
Group Member
Wed 05 May 2010 01:21:29 PM UTC, comment #1: 

I'll check the HTTP standards ... I guess the path supplied in the request ought to be escaped, but I'm not sure.

Richard Frith-Macdonald <CaS>
Group Member
Tue 04 May 2010 12:01:55 AM UTC, original submission:  

Before sending out a request, NSURLProtocol takes a valid URL and UNescapes the string (using -[NSURL fullPath], near NSURLProtocol.m:1278), so that something like

myurl.com/path/other%23info%40here

gets sent as

myurl.com/path/other#info@here

-fullPath is used in several places, so I'm not sure if that method is wrong or just the use in this case.

Adam Fedor <fedor>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #20449:  GDataLogin.m added by fedor (2KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by CaS (Posted a comment)
  • -email is unavailable- added by fedor (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-05-05 fedor Open/ClosedIn Test Closed
    2010-05-05 fedor Attached File- Added GDataLogin.m, #20449
    2010-05-05 CaS StatusNone Fixed
        Open/ClosedOpen In Test

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code